| # | Recommendation | Action | Priority | Timescales | |----|--------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|---------------------| | 1 | Define an HMRC Strategy for knowledge and information management | Promote Information Management Principles across the department, embedding expectations through regular communications. Design and share Records Management programme plan with business partners. Undertake engagement activity across HMRC, and in coordination with VOA, to implement requirements. | Medium/High| April - October 2017| | 2 | Establish clear and enforceable principles for information asset governance | Review and publicise information asset management process, ensuring GDPR and legal requirements are embedded. Define and communicate Information and Records Management roles and responsibilities across the department and VOA. Design and publish Information Asset Owner guidance. Oversee design of guidance/educational products to inform general/key roles. | Medium/High| May 2017 - March 2018| | 3 | Identify key priorities for improving information management practice and culture and driving business engagement | Build and support an education and awareness programme, helping to define and raise awareness of roles and responsibilities, knowledge and skills and the Records Management programme. Discuss and agree assurance controls with Line 1/Line 2 assurance authorities, bringing together information and records management roles to support delivery. Support the development of materials, education programme and communications. Conduct an end-to-end review of Retention and Disposal process, including reporting and controls, identifying areas for improvement throughout. Complete corporate review of retention policies, ensuring these are up to date, quality assured and easy to follow. Complete gap-analysis of outstanding retention policies and knowledge requirements. | Medium | July 2017 - March 2018| | 4 | Ensure that the IT change enables the effective management, protection and exploitation of information | Review existing change process tools to ensure Information and Records management considerations are addressed. Conduct Stakeholder consultation to define baseline for Records Management and digital continuity needs. Develop digital continuity plans and guidance to align with retention processes. Build cross department/government networks to encourage the sharing of new technology to enhance Records Management. | Medium | August 2017-March 2018| | | | | | |---|---|---|---| | 5 | Gain greater oversight of legacy information in all formats to enable effective management and control | Assess the retention requirements for migration of data into corporate platforms, including the retention process for information shared with third parties. Review the Building Our Future (BOF) Information Management process and determine where improvements are needed. Set out proposals to manage deletion targets. Develop and rollout a phased education programme to align with the Records Management timetable. | High | March 2017 - February 2018 | | 6 | Establish a definition of information and records management risk | Discuss and explore scope and alignment with other corporate information risks. Review Data, Digital and IT Strategies in order to set out requirements for Information and Records Management approach. Define further actions required to address risk gaps. Develop and build Information Management Maturity Model (IMMM) through stakeholder consultation, establishing accountability for improvements and monitoring and challenging through governance model. | Medium/High | May 2017 - May 2018 | | 7 | Strengthening current governance arrangements for information management | Define the function and purpose of renewed Tier 2 governance group, ensuring greater corporate visibility and structure. Establish clearly defined Information and Records Management roles and responsibilities to support the new governance approach. Agree priorities and actions required to conform with TNA recommendations. Establish baseline Records Management needs and assist with skills gap analysis to enable improved education and awareness across the Department. | High | May 2017 - Sept 2017 |